Compliance Auditing and Continuous Improvement Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Compliance Officers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-RM-072

Before you join: Participants should understand core finance or accounting processes, such as purchasing, payments, payroll, financial reporting or reconciliations.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Compliance failures often arise from ordinary process weaknesses rather than deliberate misconduct: incomplete approvals, poorly evidenced controls, inconsistent policy application, unmanaged third parties, or audit findings that recur without a verified fix. Finance and accounting teams must show that key obligations are understood, controls operate as designed, exceptions are investigated, and improvements are sustained. This requires more than a checklist audit; it requires a disciplined connection between regulatory obligations, risk assessment, control testing, evidence, reporting and corrective action.

This course teaches participants to plan and conduct risk-based compliance audits and convert findings into measurable improvement work. Participants work with ISO 37301 compliance management principles, ISO 19011 audit guidance, COSO ERM concepts and the IIA Global Internal Audit Standards. They learn to define audit objectives and criteria, map processes and controls, assess compliance risk, design test procedures, sample transactions, evaluate evidence, rate findings, perform root-cause analysis and monitor corrective actions. Particular attention is given to finance and accounting controls, including delegated authority, procure-to-pay, payroll, financial close, expense management, reporting and third-party payments.

Teaching combines short technical briefings with case work, audit-planning tasks, evidence review, interviews, group analysis and reporting simulations. Participants build an audit file progressively from the first week, then strengthen it through risk reassessment, finding validation and improvement planning in the second week. They leave with a completed risk-based compliance audit package, including a scope statement, risk and control matrix, test plan, findings register, corrective-action plan and management reporting format.

The course suits professionals who review, own or assure compliance controls in financial processes. It is particularly relevant where internal audit, compliance, risk, finance and operational teams need a common method for addressing control failures and preventing repeat findings.

What you will be able to do

  • Develop a risk-based compliance audit plan using defined objectives, criteria, scope and materiality
  • Apply ISO 19011 principles to audit preparation, evidence gathering, interviews and reporting
  • Build a risk and control matrix for finance and accounting compliance processes
  • Design control tests, sampling methods and working papers for auditable compliance evidence
  • Evaluate control design and operating effectiveness using documented test results
  • Write evidence-based audit findings with clear ratings, root causes and agreed actions
  • Create corrective-action plans using root-cause analysis, ownership, dates and verification criteria
  • Present a complete compliance audit report and continuous-improvement plan to management

Benefits of attending

For you

  • Conduct compliance audits with a defensible risk-based method
  • Produce clearer findings supported by sufficient and appropriate evidence
  • Assess finance controls beyond simple policy checklist reviews
  • Lead corrective-action discussions with process owners and senior managers
  • Build an audit portfolio suitable for internal audit or compliance roles

For your organisation

  • More consistent compliance audits across finance and operational processes
  • Earlier identification of control failures before regulatory or financial impact
  • Better documented evidence for management, auditors and regulators
  • Fewer repeat findings through disciplined root-cause and action tracking
  • Clearer accountability for remediation owners, deadlines and verification

Course modules

20 modules over 10 days

Participants can position compliance auditing within governance, risk management and assurance responsibilities.

  • Compliance obligations translated into auditable policies, procedures and control requirements
  • Three lines of defence accountability and audit independence boundaries
  • Board, audit committee and management responsibilities for compliance assurance
  • Assurance mapping identifies duplication, gaps and untested compliance obligations
  • Internal audit, compliance monitoring and management self-assessment compared
  • Audit charters define authority, access rights, confidentiality and reporting lines

Participants can establish clear audit criteria from legal, regulatory, policy and contractual requirements.

  • ISO 37301 compliance management system requirements and control implications
  • ISO 19011 principles for auditing management systems and programmes
  • IIA Global Internal Audit Standards applied to engagement quality
  • Legal, regulatory, contractual and policy requirements converted into criteria
  • Obligation registers assign owners, evidence sources and review frequencies
  • Criteria hierarchy resolves conflicts between laws, policies and procedures

Participants can assess inherent and residual compliance risks within finance and accounting processes.

  • Risk statements connect obligation, event, cause and possible consequence
  • Inherent risk ratings consider impact, likelihood, velocity and persistence
  • Residual risk assessment reflects control design and operating evidence
  • Procure-to-pay risks include conflicts, split orders and unauthorised suppliers
  • Financial close risks include unsupported journals and reporting misstatements
  • Risk appetite statements guide escalation thresholds and audit prioritisation

Participants can define an audit scope that concentrates effort on material compliance risk.

  • Audit universe categorises processes, entities, obligations and assurance coverage
  • Risk-based selection considers exposure, control maturity and prior findings
  • Scope statements specify entities, periods, systems, locations and exclusions
  • Materiality thresholds distinguish significant breaches from minor procedural deviations
  • Audit objectives link directly to risks, controls and criteria
  • Engagement budgets allocate hours between planning, fieldwork and reporting

Participants can document finance processes and identify controls relevant to compliance risk.

  • Swimlane maps show handoffs, approvals, systems and evidence points
  • Narratives document process purpose, trigger, activities, outputs and exceptions
  • Key controls distinguished from supporting activities and detective checks
  • Segregation-of-duties analysis identifies incompatible finance system permissions
  • Control owners, performers and reviewers assigned through RACI analysis
  • Process walkthroughs confirm documented procedures against actual transaction flow

Participants can build a risk and control matrix that supports audit planning and testing.

  • Risk and control matrix links obligations, risks, controls and evidence
  • Control objectives specify the condition required to prevent noncompliance
  • Preventive, detective, corrective and compensating controls classified accurately
  • Frequency, automation and control population recorded for each key control
  • Evidence requirements identify reports, approvals, logs and reconciliations
  • Control gaps documented where no response addresses a material risk

Participants can prepare a documented audit plan and work programme for fieldwork.

  • Planning memoranda record objectives, risks, criteria, resources and milestones
  • Audit programmes convert control objectives into sequenced test procedures
  • Working-paper indexing supports traceability from evidence to final findings
  • Request lists specify records, data extracts, policies and system reports
  • Opening meetings establish scope, protocols, contacts and escalation routes
  • Quality review points test planning completeness before fieldwork begins

Participants can obtain and assess sufficient, relevant and reliable audit evidence.

  • Audit evidence evaluated for sufficiency, relevance, reliability and source independence
  • Population definition precedes sampling of payments, journals and approvals
  • Judgmental sampling targets high-risk transactions and known exception indicators
  • Statistical sampling concepts include confidence, tolerable deviation and expected error
  • Data reliability checks reconcile extracts to source-system totals and reports
  • Chain-of-custody records protect sensitive evidence and investigation integrity

Participants can determine whether a control is suitably designed to address stated compliance risks.

  • Design testing assesses precision, frequency, authority and evidence requirements
  • Walkthroughs trace one transaction from initiation through control completion
  • Control logic tested against plausible errors, frauds and policy breaches
  • System configuration reviews examine workflow rules and approval thresholds
  • Exception handling assessed for escalation, investigation and documented resolution
  • Compensating controls evaluated where primary controls are absent or weak

Participants can test whether controls operated consistently during the audit period.

  • Operating effectiveness tests inspect performance evidence for selected control instances
  • Reperformance independently repeats reconciliations, approvals or exception reviews
  • Inquiry corroborated through documents, observations and system audit trails
  • Deviation rates calculated against defined populations and sample results
  • Missing evidence distinguished from control failure using documented criteria
  • Test conclusions state population, method, results and audit judgment

Participants can conduct focused interviews and make balanced judgments from conflicting evidence.

  • Interview plans align questions with risks, controls and evidence gaps
  • Open questions establish process understanding before testing specific assertions
  • Follow-up questions test consistency, exceptions and undocumented workarounds
  • Professional scepticism challenges unsupported explanations without assuming misconduct
  • Interview notes separate facts, representations, interpretations and follow-up actions
  • Conflicting evidence resolved through corroboration, escalation and documented judgment

Participants can convert test results into clear, consistently rated compliance findings.

  • Finding statements connect condition, criterion, cause, consequence and recommendation
  • Compliance breaches distinguished from control deficiencies and improvement opportunities
  • Finding ratings consider financial impact, regulatory exposure and control failure
  • Repeat findings analysed against prior commitments and verification evidence
  • Issue aggregation identifies systemic weaknesses hidden within individual exceptions
  • Management responses assessed for factual accuracy and ownership clarity

Participants can identify root causes and develop corrective actions that address them.

  • Five Whys traces recurring exceptions beyond immediate procedural mistakes
  • Fishbone analysis examines people, process, technology, data and governance causes
  • Root causes distinguished from symptoms, contributing factors and consequences
  • Corrective actions specify owner, milestone, resource and completion evidence
  • Preventive actions modify controls, training, systems or policy requirements
  • Action plans tested against feasibility, risk reduction and residual exposure

Participants can apply structured improvement methods to strengthen recurring compliance controls.

  • Plan-Do-Check-Act cycles structure control improvement and performance review
  • Process capability measures identify unstable controls and recurring exceptions
  • Kaizen events target waste, rework and handoff failures in compliance processes
  • Control rationalisation removes duplicate checks while preserving risk coverage
  • Standard work documents revised procedures, evidence and escalation points
  • Improvement metrics track timeliness, exception rates and closure quality

Participants can monitor remediation progress and verify that actions have resolved findings.

  • Corrective-action registers track findings, owners, dates, dependencies and status
  • Milestone reviews identify overdue actions and implementation barriers early
  • Closure evidence demonstrates completion rather than management assertion alone
  • Validation testing confirms controls operate after remedial changes
  • Residual risk reassessment determines whether further treatment remains necessary
  • Escalation protocols address stalled actions and disputed risk acceptance

Participants can design compliance reporting that supports management decisions and oversight.

  • Key risk indicators provide early warning of deteriorating compliance conditions
  • Key control indicators measure execution quality, timeliness and exception trends
  • Dashboards separate current breaches, overdue actions and emerging risk signals
  • Trend analysis compares findings by process, entity, cause and severity
  • Management reports highlight decisions required, not only audit activity
  • Data visualisation uses clear scales, definitions and source documentation

Participants can communicate audit results persuasively while preserving independence and factual accuracy.

  • Draft reports prioritise significant risks, findings and required management decisions
  • Executive summaries state assurance conclusions, themes and residual exposure
  • Closing meetings confirm facts, clarify actions and manage disagreement professionally
  • Recommendation wording focuses on outcomes, accountability and measurable completion criteria
  • Sensitive findings handled through confidentiality, escalation and need-to-know protocols
  • Audit reports distinguish agreed actions from auditor conclusions and ratings

Participants can identify practical uses of data analytics and monitoring for compliance assurance.

  • Continuous monitoring rules flag duplicate payments, threshold breaches and dormant vendors
  • Exception analytics compare approval timestamps, user access and transaction patterns
  • Journal-entry testing identifies unusual postings, late entries and manual overrides
  • Benford analysis considered cautiously alongside business context and corroborating evidence
  • Automated control reports require validation of parameters, completeness and ownership
  • Data privacy requirements govern audit data extraction, retention and access

Participants can audit third-party controls and recognise indicators requiring escalation.

  • Third-party due diligence verifies ownership, sanctions, conflicts and approval evidence
  • Vendor master controls prevent fictitious suppliers and unauthorised bank changes
  • Anti-bribery controls test gifts, hospitality, intermediaries and payment documentation
  • Fraud indicators include round amounts, split invoices and urgent overrides
  • Investigation boundaries preserve evidence and refer suspected misconduct appropriately
  • Whistleblowing arrangements assessed for confidentiality, triage and retaliation safeguards

Participants can build, review and present a complete risk-based compliance audit and continuous-improvement plan.

  • Audit scope defines obligations, processes, entities, systems and reporting period
  • Risk and control matrix prioritises material compliance exposures and controls
  • Test programme specifies samples, evidence, procedures and quality-review points
  • Findings register records condition, criterion, cause, consequence and rating
  • Corrective-action plan assigns owners, milestones, metrics and validation methods
  • Management presentation communicates assurance conclusion, priorities and implementation decisions

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Risk-based compliance audit plan template
  2. Finance process risk and control matrix
  3. Control testing work programme
  4. Audit evidence and sampling checklist
  5. Corrective-action tracking register
  6. Compliance audit report and dashboard model

Who should attend

  • Internal Auditors — need stronger methods for risk-based compliance engagements
  • Compliance Officers — must test whether obligations and policies are being followed
  • Risk Managers — need audit evidence to validate risk treatment and control performance
  • Finance Managers — oversee controls within payment, reporting and close processes
  • Financial Controllers — need to address recurring findings and control deficiencies
  • Operational Managers — own corrective actions arising from compliance reviews

Skills and tools covered

Compliance audit planningRisk and control assessmentControl testingAudit evidence evaluationRoot-cause analysisCorrective-action tracking

Tools and standards

ISO 37301, ISO 19011, COSO ERM, IIA Global Internal Audit Standards

How the course runs

Training methodology

The course uses short instructor briefings to introduce standards, audit techniques and finance-control examples. Participants analyse realistic cases involving payments, expenses, financial close, third parties and policy breaches. Group work covers process mapping, risk assessment, test design, interview preparation, evidence evaluation and finding calibration. Simulations develop questioning, closing-meeting and management-reporting skills. Individual application planning helps participants adapt the audit package to their own policies, systems, regulatory duties and assurance arrangements.

Requirements and prerequisites

Participants should understand core finance or accounting processes, such as purchasing, payments, payroll, financial reporting or reconciliations. Familiarity with internal controls, corporate policies, regulatory obligations or audit findings is useful. Participants should be able to read process documents, review transaction records and discuss control responsibilities with colleagues. Prior internal audit certification, formal legal training, statistical training and previous lead-auditor experience are not required. The course explains the audit methods, risk concepts and documentation standards used throughout.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand basic finance, accounting, risk, compliance or control processes. Previous audit experience and formal audit qualifications are helpful but not required.

Bring examples of non-confidential policies, process maps, prior findings or control issues from your workplace if permitted. A laptop is useful for developing audit documents and reviewing case materials.

It is designed for internal audit, compliance, risk, finance control and operational assurance professionals. Managers responsible for corrective actions or control ownership also benefit.

This course concentrates on compliance obligations, finance-process controls and preventing repeat findings through structured improvement. A general internal audit course usually gives broader coverage of assurance engagements and audit functions.

Participants can use the audit plan, risk and control matrix, test programme and action register for an upcoming review. The methods also support remediation of existing audit, regulatory or policy findings.

The first week builds audit foundations, risk assessment, process documentation and control testing methods. The second week focuses on findings, root causes, improvement, reporting, analytics and the final capstone audit package.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Risk Management

Risk Management Certificate Course in Financial Reporting and Treasury Risk Management 10 days · from USD 2,200 · next 16 Nov Risk Management Certificate Course in Governance, Risk and Compliance 10 days · from USD 2,200 · next 16 Nov Risk Management Certificate Course in Strategic Risk Management 10 days · from USD 2,200 · next 16 Nov Risk Management Climate Risk Management for Banks Training Course 10 days · from USD 2,200 · next 16 Nov Risk Management Compliance Management Essentials Training Course 5 days · from USD 1,100 · next 16 Nov Risk Management Compliance Management Training Course 5 days · from USD 1,100 · next 16 Nov Risk Management Contingent Liability Risk Management Training Course 5 days · from USD 1,100 · next 16 Nov Risk Management Corporate Compliance and Legal Risk Management Training Course 10 days · from USD 2,200 · next 16 Nov